CVE-2026-97163
CriticalCVSS 10.0Summary
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability. An attacker without authentication can cause malicious code to be installed in the application.
Risk Assessment
An unauthenticated attacker can remotely install arbitrary code, leading to full compromise of the Joomla site. The risk is critical because no credentials are required.
Recommendation
Update the UP extension to a version later than 6.0.29 (or 5.2.0 for the 5.x branch). If updating is not possible, consider disabling the extension.
Other vulnerabilities in Joomla UP plugin extension
See all- CVE-2026-97161Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.
- CVE-2026-97160Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an authenticated, privileged PHP command injection vulnerability. An attacker with appropriate privileges can execute arbitrary PHP commands.
Original NVD description (English source)
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Vulnerability data from NVD (NIST) · CISA KEV · EPSS